

<!DOCTYPE HTML>
<html>
<head>
  <meta charset="utf-8">
  
  <title>使用SHA1、SHA2双证书进行微软签名 | k1988</title>
  <meta name="author" content="赵海洋">
  
  <meta name="description" content="个人博客">
  
  
  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">

  <meta property="og:title" content="使用SHA1、SHA2双证书进行微软签名"/>
  <meta property="og:site_name" content="k1988"/>

  
    <meta property="og:image" content="undefined"/>
  

  <link href="/favicon.ico" rel="icon" type="image/x-ico">
  <link rel="alternate" href="http://k1988.github.com/rss.xml" title="k1988" type="application/rss+xml">
  <link rel="stylesheet" href="/css/style.css" media="screen" type="text/css">
  <!--[if lt IE 9]><script src="//html5shiv.googlecode.com/svn/trunk/html5.js"></script><![endif]-->
  <script src="//libs.baidu.com/jquery/1.8.0/jquery.min.js"></script>
</head>


<body>
  <header id="header" class="inner">
<div class="alignleft">
  <h1><a href="/">k1988</a></h1>
  <h2><a href="/"></a></h2>
</div>
<nav id="main-nav" class="alignright">
  <ul>
    
      <li><a href="/">首页</a></li>
    
      <li><a href="/archives">归档</a></li>
    
      <li><a href="/about">关于</a></li>
    
	<li> <a href="/rss.xml">RSS</a> </li>
<li> <a title="把这个链接拖到你的Chrome收藏夹工具栏中" href='javascript:(function() {
	function c() {
		var e = document.createElement("link");
		e.setAttribute("type", "text/css");
		e.setAttribute("rel", "stylesheet");
		e.setAttribute("href", f);
		e.setAttribute("class", l);
		document.body.appendChild(e)
	}
 
	function h() {
		var e = document.getElementsByClassName(l);
		for (var t = 0; t < e.length; t++) {
			document.body.removeChild(e[t])
		}
	}
 
	function p() {
		var e = document.createElement("div");
		e.setAttribute("class", a);
		document.body.appendChild(e);
		setTimeout(function() {
			document.body.removeChild(e)
		}, 100)
	}
 
	function d(e) {
		return {
			height : e.offsetHeight,
			width : e.offsetWidth
		}
	}
 
	function v(i) {
		var s = d(i);
		return s.height > e && s.height < n && s.width > t && s.width < r
	}
 
	function m(e) {
		var t = e;
		var n = 0;
		while (!!t) {
			n += t.offsetTop;
			t = t.offsetParent
		}
		return n
	}
 
	function g() {
		var e = document.documentElement;
		if (!!window.innerWidth) {
			return window.innerHeight
		} else if (e && !isNaN(e.clientHeight)) {
			return e.clientHeight
		}
		return 0
	}
 
	function y() {
		if (window.pageYOffset) {
			return window.pageYOffset
		}
		return Math.max(document.documentElement.scrollTop, document.body.scrollTop)
	}
 
	function E(e) {
		var t = m(e);
		return t >= w && t <= b + w
	}
 
	function S() {
		var e = document.createElement("audio");
		e.setAttribute("class", l);
		e.src = i;
		e.loop = false;
		e.addEventListener("canplay", function() {
			setTimeout(function() {
				x(k)
			}, 500);
			setTimeout(function() {
				N();
				p();
				for (var e = 0; e < O.length; e++) {
					T(O[e])
				}
			}, 15500)
		}, true);
		e.addEventListener("ended", function() {
			N();
			h()
		}, true);
		e.innerHTML = " <p>If you are reading this, it is because your browser does not support the audio element. We recommend that you get a new browser.</p> <p>";
		document.body.appendChild(e);
		e.play()
	}
 
	function x(e) {
		e.className += " " + s + " " + o
	}
 
	function T(e) {
		e.className += " " + s + " " + u[Math.floor(Math.random() * u.length)]
	}
 
	function N() {
		var e = document.getElementsByClassName(s);
		var t = new RegExp("\\b" + s + "\\b");
		for (var n = 0; n < e.length; ) {
			e[n].className = e[n].className.replace(t, "")
		}
	}
 
	var e = 30;
	var t = 30;
	var n = 350;
	var r = 350;
	var i = "//s3.amazonaws.com/moovweb-marketing/playground/harlem-shake.mp3";
	var s = "mw-harlem_shake_me";
	var o = "im_first";
	var u = ["im_drunk", "im_baked", "im_trippin", "im_blown"];
	var a = "mw-strobe_light";
	var f = "//s3.amazonaws.com/moovweb-marketing/playground/harlem-shake-style.css";
	var l = "mw_added_css";
	var b = g();
	var w = y();
	var C = document.getElementsByTagName("*");
	var k = null;
	for (var L = 0; L < C.length; L++) {
		var A = C[L];
		if (v(A)) {
			if (E(A)) {
				k = A;
				break
			}
		}
	}
	if (A === null) {
		console.warn("Could not find a node of the right size. Please try a different page.");
		return
	}
	c();
	S();
	var O = [];
	for (var L = 0; L < C.length; L++) {
		var A = C[L];
		if (v(A)) {
			O.push(A)
		}
	}
})()    '>High一下</a> </li>

  </ul>
  <div class="clearfix"></div>
</nav>
<div class="clearfix"></div></header>
  <div id="content" class="inner">
    <div id="main-col" class="alignleft"><div id="wrapper"><article class="post">
  
    <div class="gallery">
  <div class="photoset">
    
      <img src="">
    
  </div>
  <div class="control">
    <div class="prev"></div>
    <div class="next"></div>
  </div>
</div>
  
  <div class="post-content">
    <header>
      
        <div class="icon"></div>
        <time datetime="2016-02-03T00:28:11.000Z"><a href="/2016/02/101/">2016-02-03</a></time>
      
      
  
    <h1 class="title">使用SHA1、SHA2双证书进行微软签名</h1>
  

    </header>
    <div class="entry">
      
        <p>微软是第一个宣布了SHA-1弃用计划，在2016年之后Windows和IE将不再信任SHA-1证书。正好我们公司的数字签名也到期了，索性就重新申请了sha256和sha1的新数字证书，用来给产品签名。</p>
<p>这时就要把用了多年的自动签名脚本改为支持sha256和sha1双证书的格式。公司原使用signcode.exe和SignTool.exe两种方式进行签名，其中signcode配合另外找的signcode-pwd.exe工具和pvk+spc文件可以不需要密码即可实现签名(不在此文中详诉)，SignTool是直接用pfx证书+密码来进行签名。于是分别寻找两种方式：<br><a id="more"></a><br>查阅signcode的<a href="https://msdn.microsoft.com/zh-cn/library/9sh96ycy.aspx?f=255&amp;MSPPError=-2147217396" target="_blank" rel="external">文档</a>发现，<strong>signcode</strong>的命令行-a是用来指定数字签名的签名算法。试验了下，只支持sha1和md5，<strong>不支持sha256</strong>。所以此方法废弃。</p>
<p>再查阅<strong>SignTool</strong>的<a href="https://msdn.microsoft.com/zh-cn/library/8s9b9yaz(v=vs.110" target="_blank" rel="external">文档</a>.aspx)，支持/fd来指定签名，试了md5、sha1、sha256均支持，所以直接在原来签名代码上添加个/<strong>sa /fd sha256</strong>后如下：</p>
<blockquote>
<p>_SignTool.exe sign /v /as /ac /f D:\test\sign\sign_sha256\xxx.pfx /p xxxx /t <a href="http://timestamp.wosign.com/timestamp" target="_blank" rel="external">http://timestamp.wosign.com/timestamp</a> /fd sha256 “D:\test_double<em>signed.exe”</em><br>一开始出现/as选项不识别的问题，经研究是使用的<span style="color: #ff0000;">SignTool版本</span>为6.0,因为自己机器上装了win10的sdk，于是使用了最新的C:\Program Files (x86)\Windows Kits\10\bin\x86\signtool.exe。ps：貌似只有win10带的才支持/as选项，但nnd这货依赖的ncrypt.dll，bcrypt.dll等dll只在vista及以上系统有，所以还在用xp的同学就不要用了。如果想拷贝到其它系统上使用，同时拷贝同目录下的：<br>appxpackaging.dll</p>
<p>appxsip.dll</p>
<p>mssign32.dll</p>
<p>opcservices.dll</p>
<p>signtool.exe</p>
<p>signtool.exe.manifest</p>
<p>wintrust.dll</p>
<p>wintrust.dll.ini</p>
<p>Microsoft.Windows.Build.Appx.AppxPackaging.dll.manifest</p>
<p>Microsoft.Windows.Build.Appx.AppxSip.dll.manifest</p>
<p>Microsoft.Windows.Build.Appx.OpcServices.dll.manifest</p>
<p>Microsoft.Windows.Build.Signing.mssign32.dll.manifest</p>
<p>Microsoft.Windows.Build.Signing.wintrust.dll.manifest<br>再试验出现以下错误：<em>SignTool Error: The /t option is incompatible with the /as option.SignTool Error: Specify the RFC 3161 timestamp server’s URL instead with /tr.</em></p>
</blockquote>
<p>尝试把/t换成/tr，但是出现错误：SignTool Error: The specified timestamp server either could not be reached orreturned an invalid response.</p>
<p>经过一番努力后，将<a href="http://timestamp.wosign.com/timestamp替换成http://timestamp.wosign.com/" target="_blank" rel="external">http://timestamp.wosign.com/timestamp替换成http://timestamp.wosign.com/</a><span style="color: #ff0000;">rfc3161</span>解决问题。<a href="http://timestamp.wosign.com/rfc3161是较新的时间戳服务格式，兼容/t和" target="_blank" rel="external">http://timestamp.wosign.com/rfc3161是较新的时间戳服务格式，兼容/t和</a><span style="color: #ff0000;">/tr</span>，而<a href="http://timestamp.wosign.com/timestamp只适用于/t。" target="_blank" rel="external">http://timestamp.wosign.com/timestamp只适用于/t。</a></p>
<p>最后将两个签名指令放到批处理文件里：</p>
<blockquote>
<p>set sign_folder=%~dp0%%sign_folder%\SignTool.exe sign /v /f %sign_folder%example.pfx /p examplepassword <span style="color: #ff0000;">/tr <a href="http://timestamp.wosign.com/rfc3161" target="_blank" rel="external">http://timestamp.wosign.com/rfc3161</a> /fd sha1</span> “%1”%sign_folder%\SignTool.exe sign /v <span style="color: #ff0000;">/as</span> /f %sign_folder%example.pfx /p examplepassword<span style="color: #ff0000;"> /tr <a href="http://timestamp.wosign.com/rfc3161" target="_blank" rel="external">http://timestamp.wosign.com/rfc3161</a> /fd sha256</span> “%1”<br>别的自动脚本里在想要签名文件时，只需要调用sign.bat “要签名的文件的全路径”即可</p>
</blockquote>

      
    </div>
    <footer>
      
        
  
  <div class="categories">
    <a href="/categories/系统-工具/">系统/工具</a>
  </div>

        
  
  <div class="tags">
    <a href="/tags/sha256/">sha256</a>, <a href="/tags/数字签名/">数字签名</a>
  </div>

<!-- Baidu Button BEGIN -->
<div id="bdshare" class="bdshare_t bds_tools_32 get-codes-bdshare">
<a class="bds_qzone"></a>
<a class="bds_tsina"></a>
<a class="bds_tqq"></a>
<a class="bds_renren"></a>
<a class="bds_t163"></a>
<span class="bds_more"></span>
<a class="shareCount"></a>
</div>
<script type="text/javascript" id="bdshare_js" data="type=tools&amp;uid=3326447" ></script>
<script type="text/javascript" id="bdshell_js"></script>
<script type="text/javascript">
document.getElementById("bdshell_js").src = "http://bdimg.share.baidu.com/static/js/shell_v2.js?cdnversion=" + Math.ceil(new Date()/3600000)
</script>
<!-- Baidu Button END -->      
      <div class="clearfix"></div>
    </footer>
  </div>
</article>



 <nav id="pagination" >
    
    <a href="/2016/07/libtorrent打洞分析/" class="alignleft prev" >上一页</a>
    
    
    <a href="/2015/08/99/" class="alignright next" >下一页</a>
    
    <div class="clearfix"></div>
</nav>

<section id="comment">

<!-- 多说评论框 start -->
	<div class="ds-thread" data-thread-key="/2016/02/101/" data-title="使用SHA1、SHA2双证书进行微软签名" data-url="/2016/02/101/"></div>
<!-- 多说评论框 end -->
<!-- 多说公共JS代码 start (一个网页只需插入一次) -->
<script type="text/javascript">
var duoshuoQuery = {short_name:"k1988"};
	(function() {
		var ds = document.createElement('script');
		ds.type = 'text/javascript';ds.async = true;
		ds.src = (document.location.protocol == 'https:' ? 'https:' : 'http:') + '//static.duoshuo.com/embed.js';
		ds.charset = 'UTF-8';
		(document.getElementsByTagName('head')[0] 
		 || document.getElementsByTagName('body')[0]).appendChild(ds);
	})();
	</script>
<!-- 多说公共JS代码 end -->

  
</section>

</div></div>
    <aside id="sidebar" class="alignright">
  <div class="search">
  <form action="//google.com/search" method="get" accept-charset="utf-8">
    <input type="search" name="q" results="0" placeholder="搜索">
    <input type="hidden" name="q" value="site:baba.zhaoxiuyuan.com">
  </form>
</div>

  
<div class="widget tag">
  <h3 class="title">分类</h3>
  <ul class="entry">
  
    <li><a href="/categories/C/">C++</a><small>4</small></li>
  
    <li><a href="/categories/net/P2P/">P2P</a><small>2</small></li>
  
    <li><a href="/categories/WEB/">WEB</a><small>1</small></li>
  
    <li><a href="/categories/WINDOWS编程/">WINDOWS编程</a><small>6</small></li>
  
    <li><a href="/categories/bugs/">bugs</a><small>2</small></li>
  
    <li><a href="/categories/ie/flash/">flash</a><small>1</small></li>
  
    <li><a href="/categories/ie/">ie</a><small>1</small></li>
  
    <li><a href="/categories/java/">java</a><small>5</small></li>
  
    <li><a href="/categories/java/minecraft/">minecraft</a><small>2</small></li>
  
    <li><a href="/categories/net/">net</a><small>2</small></li>
  
    <li><a href="/categories/python/">python</a><small>1</small></li>
  
    <li><a href="/categories/windows/">windows</a><small>2</small></li>
  
    <li><a href="/categories/bugs/windows/">windows</a><small>1</small></li>
  
    <li><a href="/categories/工具/">工具</a><small>1</small></li>
  
    <li><a href="/categories/开源项目/">开源项目</a><small>2</small></li>
  
    <li><a href="/categories/未分类/">未分类</a><small>0</small></li>
  
    <li><a href="/categories/系统-工具/">系统/工具</a><small>7</small></li>
  
    <li><a href="/categories/软件/">软件</a><small>2</small></li>
  
  </ul>
</div>


  <div class="widget tag">
<h3 class="title">简介</h3>
<ul class="entry">
<li>本体：赵海洋</li>
<li>二次元：k1988 | 赵大海</li>
<li>现状：大蓝鲸某IT公司研发部经理</li>
<li>QQ 号：1811132352</li>
<li>早期博客：<a href="http://blog.csdn.net/k1988/">CSDN博客</a></li>
</ul>
</div>



  <iframe width="100%" height="550" class="share_self"  frameborder="0" scrolling="no" src="http://widget.weibo.com/weiboshow/index.php?language=&width=0&height=550&fansRow=2&ptype=1&speed=0&skin=1&isTitle=1&noborder=1&isWeibo=1&isFans=1&uid=1196349092&verifier=d3636f5c&dpc=1"></iframe>
</aside>
    <div class="clearfix"></div>
  </div>
  <footer id="footer" class="inner"><section>
Theme of <a href="https://github.com/k1988/lightum">Lightum</a>, Improved from <a href="https://github.com/hexojs/hexo-theme-light">Light</a>, by <a href="/">k1988</a> 
<script async src="//dn-lbstatics.qbox.me/busuanzi/2.3/busuanzi.pure.mini.js"></script>
<span id="busuanzi_container_site_pv">本站总访问量<span id="busuanzi_value_site_pv"></span>次</span>
</section>
<div class="clearfix"></div>
</footer>
  <script src="//libs.baidu.com/jquery/2.0.3/jquery.min.js"></script>
<script src="/js/jquery.imagesloaded.min.js"></script>
<script src="/js/gallery.js"></script>




<link rel="stylesheet" href="/fancybox/jquery.fancybox.css" media="screen" type="text/css">
<script src="/fancybox/jquery.fancybox.pack.js"></script>
<script type="text/javascript">
(function($){
  $('.fancybox').fancybox();
})(jQuery);
</script>


<!-- mathjax config similar to math.stackexchange -->

<script type="text/x-mathjax-config">
  MathJax.Hub.Config({
    tex2jax: {
      inlineMath: [ ['$','$'], ["\\(","\\)"] ],
      processEscapes: true
    }
  });
</script>

<script type="text/x-mathjax-config">
    MathJax.Hub.Config({
      tex2jax: {
        skipTags: ['script', 'noscript', 'style', 'textarea', 'pre', 'code']
      }
    });
</script>

<script type="text/x-mathjax-config">
    MathJax.Hub.Queue(function() {
        var all = MathJax.Hub.getAllJax(), i;
        for(i=0; i < all.length; i += 1) {
            all[i].SourceElement().parentNode.className += ' has-jax';
        }
    });
</script>

<script type="text/javascript" src="http://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML">
</script>
</body>
</html>


<a href="https://github.com/k1988" target="_blank"><img style="position: absolute; top: 0; left: 0; border: 0;" src="/imgs/forkme_left_green_007200.png" alt="Fork me on GitHub"></a>
